HackTheBox - LaCasaDePapel

Name: HackTheBox - LaCasaDePapel
Uploaded: 2019-07-27T15:00:02Z
Channel: IppSec
Description: 01:05 - Start of nmap 02:50 - Attempting to execute an VSFTPD Backdoor via MSF 03:40 - Discovering the backdoor opened 6200, discovering a weird shell 0...

IppSec · Beginner ·🔐 Cybersecurity ·6y ago

01:05 - Start of nmap 02:50 - Attempting to execute an VSFTPD Backdoor via MSF 03:40 - Discovering the backdoor opened 6200, discovering a weird shell 04:50 - Lets figure out what just happened 06:50 - Triggering the backdoor without Metasploit 09:05 - Exploring the Psy PHP Shell opened up by the backdoor 10:20 - Several functions for executing bash aren't working, checking disable_functions 11:40 - Attempting to bypass disabled_functions (does not work) 12:50 - Using ScanDir() and File_Get_Contents(), to explore the filesystem 14:50 - Identifying we are probably running as the Dali User (Unin…

Watch on YouTube ↗ (saves to browser)

Chapters (30)

1:05 Start of nmap

2:50 Attempting to execute an VSFTPD Backdoor via MSF

3:40 Discovering the backdoor opened 6200, discovering a weird shell

4:50 Lets figure out what just happened

6:50 Triggering the backdoor without Metasploit

9:05 Exploring the Psy PHP Shell opened up by the backdoor

10:20 Several functions for executing bash aren't working, checking disable_function

11:40 Attempting to bypass disabled_functions (does not work)

12:50 Using ScanDir() and File_Get_Contents(), to explore the filesystem

14:50 Identifying we are probably running as the Dali User (Unintended Path)

17:00 Downloading CA.KEY, which is a private key to a webserver

21:40 Using the CA.KEY to generate client certificates to access the HTTPS Page

30:25 Weird it didn't work, lets just verify all our certificates are good

32:28 This time it worked! We connected to the server

33:20 Failing to add the certificate to BurpSuite

33:50 Discovering File Traversal by editing the PATH variable

36:38 Discovering the LFI just puts the path as Base64 Encoded

37:15 Using the LFI to download the SSH Private Key

38:45 Testing SSH Key against users on the box to gain access!

39:13 UNINTENDED: Skipping the HTTPS Certificate - Generating SSH Keys to upload via

40:30 UNINTENDED: Using file_put_contents() to append our public key to authorized_k

41:30 UNINTENDED: Using SSH to tunnel through Dali (SOCKS Proxy)

42:30 UNINTENDED: Scanning ports on Dali that are listening on LocalHost

43:08 UNINTENDED: Port 8000 is open, and its one step after the Reverse_Proxy that p

45:35 Running PSPY and LinEnum

50:20 Using PSPY to view FileSystem Events which will show the cron

52:30 Taking control of ~/memcached.ini because we own the folder!

54:45 Exploiting the cron that utilizes memcached.ini to get a root shell

55:55 Exploring how the SSL Authentication is working

1:00:00 Exploring how the VSFTPD Backdoor was modi

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →